Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-54414— Anubis accepts crafted redirect URLs in pass-challenge 'Try Again' buttons

Quick assessment

Affected
TecharoHQ anubis
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Anubis是Xe Iaso个人开发者的一个工具。 Anubis 1.21.2及之前版本存在安全漏洞，该漏洞源于恶意pass-challenge页面可能导致执行任意JavaScript代码。

AI Predicted 6.1 Difficulty: Moderate EPSS 0.48% · P39
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-54414

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Anubis accepts crafted redirect URLs in pass-challenge 'Try Again' buttons
Source: CVE Program / CVE List V5
Vulnerability Description
Anubis is a Web AI Firewall Utility that weighs the soul of users' connections using one or more challenges in order to protect upstream resources from scraper bots. In versions 1.21.2 and below, attackers can craft malicious pass-challenge pages that cause a user to execute arbitrary JavaScript code or trigger other nonstandard schemes. An incomplete version of this fix was tagged at 1.21.2 and then the release process was aborted upon final testing. To work around this issue: block any requests to the /.within.website/x/cmd/anubis/api/pass-challenge route with the ?redir= parameter set to anything that doesn't start with the URL scheme http, https, or no scheme (local path redirect). This was fixed in version 1.21.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Anubis 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Anubis是Xe Iaso个人开发者的一个工具。 Anubis 1.21.2及之前版本存在安全漏洞，该漏洞源于恶意pass-challenge页面可能导致执行任意JavaScript代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
TecharoHQ anubis < 1.21.3 -

II. Public POCs for CVE-2025-54414

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-54414

请登录查看更多情报信息。

Vendor Advisories for CVE-2025-54414 (1)

IV. Related Vulnerabilities

Same product: anubis
Same vendor: TecharoHQ
Same weakness: CWE-80

V. Comments for CVE-2025-54414

No comments yet

Leave a comment